GHSA-x4m5-j4x4-4wjg

Jenkins allows Administrators to Access API Tokens

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-5323

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	< 1.625.2	1.625.2
Maven	org.jenkins-ci.main:jenkins-core	>= 1.626, < 1.638	1.638

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-5323 advisory
https://github.com/jenkinsci/jenkins/commit/b3f16489ad5f15c3e749ed066cf6b4251f6668c6 web
https://access.redhat.com/errata/RHSA-2016:0070 web
https://github.com/jenkinsci/jenkins package
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 web
http://rhn.redhat.com/errata/RHSA-2016-0489.html web